Showing posts with label Whitepaper. Show all posts
Showing posts with label Whitepaper. Show all posts
Subscribe to the RSS feed in case you are interested in updates
My professional and private commitments made it difficult to maintain a healthly blogging style, I am trying to get back to some blogging on a more regular basis.
Quick Update:
- G-SEC does no longer operate on a commercial basis, for those that want to join the G-SEC Team and blogging platform drop me (Thierry) a mail.
- I updated the "TLS/SSL hardening and compatibility Report" to 2011
TLS/SSL hardening and compatibility Report 2011
Notable Changes:
- Chrome moved from SCHANNEL to NSS, this move enhances the ciphersuites available to XP systems considerably (compared to IE)
- Added OPERA ciphersuites
- Updated: Restructured Tables to reflect usage of NSS by Firefox and Chrome
- Updated: Fixed typos
Note: I have not re-tested all browsers completely, if you find errors please let me know. The report is can be downloaded here
Signed - Thierry Zoller
Subscribe to the RSS feed in case you are interested in updates
PS: In order to know whether this type of publication is useful to some and whether I should spend time on such publications in the future, I would appreciate a heads-up if you find this to be interesting. Thierry
At last. What started as an "I need an overview of best practise in SSL/TLS configuration" type of idea, ended in a 3 month code, reverse engineer and writing effort. I really hope this comes in handy for you and was worth the effort. This is the "Release candidate" version of the paper, should no errors be found it will be the final version.
This paper aims at answering the following questions :
- What SSL/TLS configuration is state of the art and considered secure (enough) for the next years?
- What SSL/TLS ciphers do modern browsers support ?
- What SSL/TLS settings do server and common SSL providers support ?
- What are the cipher suites offering most compatibility and security ?
- Should we really disable SSLv2 ? What about legacy browsers ?
- How long does RSA still stand a chance ?
- What are the recommended hashes,ciphers for the next years to come
The paper includes two tools :
Without further ado here is the complete package
PS: In order to know whether this type of publication is useful to some and whether I should spend time on such publications in the future, I would appreciate a heads-up if you find this to be interesting. Thierry
Subscribe to the RSS feed in case you are interested in updates
This paper explains the vulnerability for a broader audience and summarizes the information that is currently available. The document is prone to updates and is believed to be accurate by the time of writing.
- Updated 18.11.2009 : Added SMTP over TLS attack scenario, added s_client testcase
- Updated 30.11.2009 : Added FTPS analysis, new attacks against HTTPS (injecting responses and downgrading to HTTP)
- Updated 09.12.2009 : Proof of concept files for TRACE and 302 redirect using TLS rengotiation flaw
Download "TLS / SSLv3 renegotiation vulnerability explained"
posted by Thierry Zoller
Related post: Vulnerabilities like it's 1999 SSLv3 / TLS Man in the Middle vulnerability - update #8
Subscribe to:
Posts (Atom)
Posts
